Vulnerability management

Posted by defiantarch@reddit | linuxadmin | View on Reddit | 29 comments

The latest vulnerabilities in the kernel and nginx and its management by Ubuntu and Debian has shown me the risk of relying on them. With respect to the CVSS scores I found their reaction exceptionally slow, compared to Proxmox for example. My question: Which Linux server distribution is having the best vulnerability management in your opinion? And which is most suited from the management perspective?

Reply to Post

29 Comments

[-]

chock-a-block@reddit

A very complicated operating system that is free in every sense of the word doesn’t move fast enough for you? I’m sure IBM/Oracle are happy to help.

[-]

defiantarch@reddit (OP)

That's not what I was after. Some distributions are faster than others, I picked Proxmox as they cherry picked the kernel patches very fast. While when looking at cti.wazuh.com it shows many vulnerabilities never been fixed by Ubuntu. So, its more a question of who's having a reliable vulnerability management in place when it comes to critical CVE:s.

[-]

pouetpouetcamion2@reddit

du coup quelle distribution rencontre vos critères? ca m interesse.

[-]

wezelboy@reddit

NGL- Oracle has been very quick to respond to these latest vulnerabilities in the UEK kernel. And I hate Oracle more than most people.

[-]

pobrika@reddit

Nah me more than you.

[-]

wezelboy@reddit

I will always upvote anyone who hates Oracle more than me.

[-]

KageRaken@reddit

Those recent high profile vulnerabilities came with mitigations that took me all but 10 minutes to implement in our ansible code. Running through all the required tests before promotion to prod took a while, but that's automated anyway. For all the dust they kicked up, it didn't rock the boat that much. As others said, stability is key here, and the combination of easy mitigation and our siem being fast in recognising and blocking our attempts to even test the pocs, meant I didn't lose any sleep over them. Security in layers is key.

[-]

defiantarch@reddit (OP)

I agree for sure and do not get why the hack I got downvoted here. Seem to be a really toxic subreddit. Anyway, I left the sub and will discuss the topic elsewhere.

[-]

forbiddenlake@reddit

You can always use containers for your apps. So you can react to upstream releases faster, and the cost of you now being responsible for updating them and possibly building them.

[-]

defiantarch@reddit (OP)

Sure, I use containers where they are feasible. But I don't run containers for services exposed to the internet. I don't like container breakouts, not even with id mapping and least privileges as that only works as long as the surrounding machine is bot vulnerable as well.

[-]

forbiddenlake@reddit

I feel like a rootless container is more secure than running the app directly on the host. NGINX has an apt repo you can use if you don't like Debian's speed: https://nginx.org/en/linux_packages.html

[-]

defiantarch@reddit (OP)

Again, I never said that I run things directly on the machine. I rather use VM:s and sometimes containers inside them, depending on the service.

[-]

MightyBigMinus@reddit

you don't like that they can sometimes break out and therefore you just never contain them in the first place? that makes no sense.

[-]

defiantarch@reddit (OP)

What? I never wrote that. I contain them of course. There're more solutions than docker or lxc containers.

[-]

pondi@reddit

It’s slow because it is stable. If you want quick daily fixes then run Sid or Forky branch and enjoy the lack of stability.

[-]

CardOk755@reddit

Not true.

[-]

defiantarch@reddit (OP)

How stable is a vulnerable installation with critical CVE:s not patched and getting a record in CISA:s KVE database? Maybe I asked my question in the wrong forum. In that case: I'm sorry for disturbing this sub.

[-]

PerspectiveAlert4766@reddit

Quite stable. Known vulnerabilities/errors could be protected with additional security, but unknown bug from poorly tested changes could be fatal.

[-]

Overall_History6056@reddit

Perhaps you have not dealt with systems that if they went down heads gonna roll, market gonna crash, people might die kinda situations and thus don't care about about stability nearly as much. In those scenarios the servers are generally deep within firewalls and the probability of any unpatched cve been exploited is low. But the potential downside of a system crash due to an immature fix is very high.

[-]

Il_Falco4@reddit

We are slowly moving over to fedora servers that autoupdate. So far so good.

[-]

defiantarch@reddit (OP)

At my job we're running almalinux, they were a bit faster than Ubuntu and Debian which so far are used to. However, maybe I should take the step away from Debian based distros back to redhat based ones...

[-]

Il_Falco4@reddit

We are tracking the compliancy and vulns between the two and with the autoupdate fedora is quit fast.

[-]

Burgergold@reddit

A rock is pretty more secure than an OS

[-]

rankinrez@reddit

Kind of wild you’re blaming the distros for this. I would say Debian are good. But if you can’t wait for them to catch up when shit is dropped on them with no warning then you gotta monitor the kernel lists yourself.

[-]

defiantarch@reddit (OP)

Well, why is that? The distros liability lies in selecting packages with reliable maintainers behind, right? At least if you claim security by design. So, what's wrong in blaming distros not taking care or (in Ubuntus case) igoring critical CVE:s and downplaying them?

[-]

pobrika@reddit

The distro provides the software repository but the job of fixing the bugs are down to the package maintainers, so Debian is waiting for the patches often before they can build a new package. This then goes to a bleeding edge repo where it's tested and then goes I to the standard repo. You can choose to download the source and patch yourself if you want it done faster, else choose bleeding edge repos or waiting for the security updates. All vendors do it the same way. I find Debian faster, then Ubuntu and then redhat and oracle, after redhat comes rocky and Alma. Not sure about slack or use etc as I don't use them, not sure about alpine either.

[-]

rankinrez@reddit

You’re talking about kernel vulnerabilities. So no.

[-]

defiantarch@reddit (OP)

Well, I said kernel and nginx as the latest prominent examples. I could give other examples, like apache. The kernel is at least always part of any distro, right?

[-]

orev@reddit

You're getting caught up in the hype of all these vulnerabilities. Many require that users already have local access to the machine, or some other type of situation. If you're concerned about proper security, you should already have multiple layers of other protections, like firewalls, segregated networks, server hardening, application hardening, etc. And there are responses to a vulnerability other than simply patching it, such as taking other measures to reduce your exposure. It's not feasible for everything to be patched immediately all the time, so this approach needs to be part of your regular strategy.